Finding and Understanding Bugs in C Compilers.

Yang, X., Chen, Y., Eide, E., & Regehr, J. (2011). Finding and Understanding Bugs in C Compilers. Proceedings of the 32nd ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI 2011), 283-294.

Type

Conference paper

Intellectual base

Primary research

Year

2011

Pages

283-294

DOI

10.1145/1993498.1993532

DOI registrant

Association for Computing Machinery

Link

https://doi.org/10.1145/1993498.1993532

Cited from

computer_science

Cited by

2 citations across 2 artifacts.

Each citation links to the sentence it supports in the citing article.

Primes

• Fuzzing
  • In protocol and network testing it is the fuzzing of TLS implementations, DNS resolvers, and compilers.

    This sourcePresents Csmith, a randomized generator that fuzzes C compilers by differential testing, finding 325+ previously unknown bugs — the compiler/protocol-implementation instance of fuzzing.

    Supported in partVerified against the work's full text

    Csmith paper supports fuzzing of C compilers only; it says nothing about TLS implementations, DNS resolvers or protocol and network testing.

    “Random testing [9], also called fuzzing [17], is a black-box testing method in which test inputs are generated randomly.”

    Read by an automated reader; not a human review. How support was checked

Domain-specific

• Formal Verification
  • The payoff was measured empirically: in the Csmith random-testing study (Yang, Chen, Eide, and Regehr, PLDI 2011), the researchers found and reported many wrong-code bugs in GCC and LLVM but essentially none in CompCert's verified middle-end

    This sourceThe Csmith random-testing study, which reported hundreds of GCC and LLVM bugs but found no middle-end bugs in CompCert, whose only defects lay in unverified parts.

    SupportedVerified against the source

    Read by an automated reader; not a human review. How support was checked

Verification

Does it exist? Confirmed. This work's DOI resolves to a registered record, which fixes its identity. That is all it fixes.

Does it back the claim? Read against the text for 2 of 2 citations: 1 supported, 1 supported in part. Each verdict is shown under its citation below, with what in the work backs the sentence.

Support is checked per citation rather than per work — the same source can be cited soundly in one article and wrongly in another. Per-citation recording began recently, so a citation with no recorded check is a gap in the record rather than evidence it went unchecked.

See how references were verified.

Registry ID ref:6694213f3402 · see in the full table